Which versions of Vitec Flamingo are affected by CVE-2026-60121?

Vitec Flamingo 4.12.2 contains a critical unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary commands with root privileges on IPTV distribution…

Is there a public PoC exploit available for CVE-2026-60121?

Yes, a public proof-of-concept exploit is available for CVE-2026-60121. Prioritise patching immediately. EPSS: 1.4%.

How to fix or mitigate CVE-2026-60121?

Within 24 hours, conduct a complete inventory of Vitec Flamingo 4.12.2 deployments and immediately restrict network access to the admin interface using firewall rules. Within 7 days, deploy a Web Application Firewall (WAF) rule blocking all requests to /admin/ajax/ping.php, implement network segmentation isolating Flamingo servers from production systems, and enable detailed request logging on the admin interface. Within 30 days, establish a vendor patch monitoring process, evaluate available upgrade paths once patches are released, and develop a timeline for migration to patched versions.

Vitec Flamingo CVE-2026-60121

Q: What is the CVSS score of CVE-2026-60121?

CVE-2026-60121 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

CRITICAL

OS Command Injection (CWE-78)

2026-07-13 VulnCheck

PHP Command Injection Flamingo Vitec

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable unauthenticated endpoint (AV:N/PR:N/UI:N) with trivial injection (AC:L) yielding root command execution, so full C/I/A impact; scope unchanged as impact stays within the appliance OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 14:00 vuln.today

CVE Published

Jul 13, 2026 - 13:11 cve.org

CRITICAL 9.3

DescriptionCVE.org

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.

Articles & Coverage 1

News Critical OS Command Injection in PHP Vitec Flamingo 4.12.2 - CVE-2026-60121 Jul 13, 2026

AnalysisAI

Unauthenticated OS command injection in Vitec Flamingo 4.12.2 (IPTV distribution) lets remote attackers run arbitrary commands as root through the admin/ajax/ping.php endpoint. The flaw stems from a double-evaluation bug where a system wrapper re-uses the decoded, un-escaped host value in a second shell call executed via passwordless sudo. Publicly available exploit code exists (VulnCheck); no active exploitation is confirmed in CISA KEV at time of analysis.

Technical ContextAI

The affected component is a PHP web-admin interface (cpe:2.3:a:vitec:flamingo) for Vitec's Flamingo IPTV distribution platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The application does attempt sanitization - escapeshellarg() is applied to the user-supplied 'host' POST parameter - but the value is passed to a separate system wrapper binary/script that reads the already-decoded argument from argv and re-inserts it into a second shell_exec() invocation without re-escaping. This 'double evaluation' defeats the first layer of escaping: the shell metacharacters that escapeshellarg() neutralized on the first pass are decoded back to their literal form before the second, unescaped shell call runs. Because that second call executes under passwordless sudo, injected commands run with root privileges.

RemediationAI

No vendor-released patch version is identified in the available data, so no fixed release can be cited; monitor Vitec and the VulnCheck advisory (https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-php) for an official update and apply it as the primary fix once published. As compensating controls, restrict network access to the admin interface so admin/ajax/ping.php is not reachable from untrusted networks (place it behind a VPN or IP allowlist), which blocks the network attack vector at the cost of remote-admin convenience. If the ping diagnostic feature is non-essential, disable or remove the admin/ajax/ping.php endpoint (e.g., via web-server deny rules) to eliminate the vulnerable path, accepting loss of that diagnostic function. Additionally, remove the passwordless sudo grant used by the ping wrapper so that even a successful injection cannot escalate to root - this reduces impact from root RCE to lower-privilege execution but may break the ping feature's intended operation. A WAF rule blocking shell metacharacters in the 'host' parameter can serve as a stopgap but is bypass-prone and should not be relied on alone.